DCSA NISP Compliance Guide

What Is the DCSA National Industrial Security Program?

The National Industrial Security Program (NISP) is the framework established by Executive Order 12829 under which the U.S. government protects classified information held by cleared defense contractors. The Defense Counterintelligence and Security Agency (DCSA) — formed in 2020 from the merger of DSS and part of DCIO — administers NISP on behalf of over 13,000 cleared facilities across the defense industrial base.

Unlike CMMC (which governs CUI handling under DoD contracts), NISP governs the handling of classified information — material marked Secret, Top Secret, or Sensitive Compartmented Information (SCI). If your company performs work on classified contracts or stores classified material, NISP compliance is mandatory, not optional.

DCSA's role includes:

• Adjudicating facility clearance (FCL) requests for cleared contractors
• Monitoring cleared facilities through Industrial Security Representatives (ISRs)
• Managing FOCI (Foreign Ownership, Control, or Influence) determinations and mitigation agreements
• Operating the DCSA Portal (eFCL, NISS, and other systems)
• Conducting facility inspections and vulnerability assessments
• Providing guidance via the NISP Operating Manual (NISPOM)

Facility Clearance Tiers

Facility Clearance (FCL) is the approval granted to a contractor to access classified information. FCL is granted at one of four levels, each authorizing access to a corresponding level of classified information. The clearance is issued to the facility, not to individuals — individual personnel need their own Personnel Clearance (PCL) in addition to working at a cleared facility.

The first step in NISP compliance is determining the clearance level your facility needs, based on the classified work you perform or expect to perform.

The SF-328 — Certificate Pertaining to Foreign Interests

The Standard Form 328 (SF-328) is the mandatory form submitted with every Facility Clearance request. It captures information about the company's ownership structure, foreign affiliations, foreign nationals, and any existing or past relationships with foreign entities.

DCSA uses the SF-328 to assess FOCI risk before granting facility clearance. Incomplete or inaccurate SF-328 submissions are one of the top reasons for FCL processing delays. Companies with any foreign ownership — including passive investment, board members, or joint venture partners from foreign countries — must disclose this on the SF-328, even if it seems minor.

How to Apply for Facility Clearance

1. Obtain a CAGE code from SAM.gov if you don't already have one — required for all DCSA submissions
2. Register in the DCSA Portal (see the DCSA Portal Onboarding section below)
3. Complete SF-328 — disclose all foreign ownership, control, influence, and foreign national involvement
4. Submit via eFCL in the DCSA Portal — your ISR will review and route for adjudication
5. Complete FOCI determination if foreign interests are present (see FOCI section)
6. Receive FCL letter — typically 60–120 days for new applications; existing companies moving from DSS may be faster

FOCI Mitigations

Foreign Ownership, Control, or Influence (FOCI) exists when a foreign person or entity holds a certain percentage of ownership, controls the company through debt or governance rights, or otherwise exerts influence over the company's decisions related to classified information. FOCI does not automatically disqualify a company from receiving facility clearance — but it must be identified, assessed, and mitigated through an approved instrument.

DCSA uses a tiered approach: low-level FOCI may be eligible for a mitigated determination without a formal agreement, while higher-level FOCI requires a formal mitigation instrument approved by DCSA and the relevant Cognizant Security Agency (CSA).

FOCI Categories and Mitigation Instruments

Proxy Agreement

The Proxy Agreement is the most common formal FOCI mitigation instrument for companies with direct foreign ownership or control. Under a Proxy Agreement, a U.S. citizen proxy — often a senior executive with no financial ties to the foreign owner — is granted sole authority to make all decisions related to the company's facility clearance, classified contracts, and security policies.

The foreign owner is effectively walled off from any classified information decisions. The proxy must:

• Be a U.S. citizen with no financial relationship to the foreign owner
• Have authority to direct the company's FCL-related decisions independently
• Report to DCSA and the ISR on FCL matters without foreign owner interference
• Maintain documentation proving proxy independence in all classified-related decisions

Special Security Agreement (SSA)

The Special Security Agreement is used when a company has foreign investment that creates FOCI but where a full Proxy Agreement is not the best fit — often for companies with multiple foreign investors or complex governance structures. Under an SSA, a Governance Committee (GC) composed of cleared U.S. citizens makes all decisions about classified access and FCL matters. Foreign owners are excluded from the GC and from any role in classified program decisions.

The SSA requires:

• A GC of at least three cleared U.S. citizens (five for SCI-cleared companies)
• GC decisions on all classified access, facility clearance matters, and contractor program participation
• Annual GC compliance certifications submitted to DCSA
• No foreign national access to classified information without a separately approved exception

NISPOM Requirements — What Every Cleared Facility Must Do

The NISP Operating Manual (NISPOM) (32 CFR Part 117, formerly 32 CFR Part 2004) is the authoritative guide to industrial security requirements. Chapter 8 of NISPOM establishes the security requirements that cleared facilities must meet. Key obligations include:

Information Systems Security

Companies that process classified information on IT systems must implement controls consistent with the appropriate security manual (RMP for collateral, ICD 703 for SCI). This includes:

• Configuration management and accreditation of classified systems
• Access control — need-to-know basis, role-based access, regular access reviews
• Audit logging and monitoring — retaining logs for the period required by the applicable security manual
• Media protection — classified media must be stored in approved containers, logged, and inventoried regularly
• Incident reporting — any compromise or suspected compromise of classified information must be reported to DCSA within prescribed timeframes

Personnel Security

• All employees with access to classified information must have a Personnel Clearance (PCL) or be under supervision by someone with PCL
• Security briefings for all personnel granted access to classified information
• Regular refresher briefings (typically annual)
• Reporting requirements — changes in personal circumstances that could affect clearance eligibility (foreign travel, foreign contacts, financial issues)

Physical Security

• Approved storage containers for classified material (TL-rated safes, GSA-approved containers)
• Visitor control procedures — escorts for uncleared visitors in areas where classified information is accessible
• Contraband procedures — prohibition of unauthorized personal electronic devices in classified areas
• Security-in-depth: perimeter controls, intrusion detection, alarm monitoring

Security Training and Briefings

All cleared employees must complete initial security awareness training before accessing classified information and annual refresher training thereafter. Records of all training must be maintained.

Classified Contract Handling

Classified contracts involve the creation, handling, storage, and transmission of classified information. The process starts with the contract award package and extends through contract completion and the classified information disposition phase.

DD Form 254 — The Classified Contract Security Requirements Document

The DD Form 254 (Contract Security Classification Specification) is the mandatory document attached to every classified contract. It specifies the classification level and categories of classified information the contractor will access, the security requirements the contractor must meet, and any special handling instructions. The contractor must acknowledge receipt of the DD Form 254 before classified work begins.

Classified Subcontracting Flow-Downs

Prime contractors are responsible for ensuring that classified requirements are properly flowed to subcontractors. For every subcontract involving classified information, the prime must:

• Include a DD Form 254 with the subcontract award
• Verify the subcontractor has an appropriate FCL (or apply for one on their behalf)
• Confirm the subcontractor's FOCI status is resolved or mitigated
• Maintain visibility into the subcontractor's security compliance throughout the contract period

Contract Completion and Classified Information Disposition

When a classified contract ends, classified information must be properly dispositioned — returned to the government, destroyed, or transferred to another cleared facility under authorization. NISPOM specifies requirements for:

• Classified material inventory and accountability — all classified must be accounted for at contract close
• Destruction certificates — documenting the destruction of classified material using approved methods
• Transfer of custody — material moving to another facility requires a DD Form 209 (Classified Material Transmittal form)
• Long-term storage — if classified material must be retained after contract close, a separate storage agreement is required

DCSA Portal Onboarding

The DCSA Portal (at dcsa.mil) is the central system for all facility-level interactions with DCSA. It replaced the legacy DSS systems (e.g., eQIP, eFCL) and provides a unified interface for FCL management, reporting, training records, and ISR communications.

Getting Access to the DCSA Portal

Registration requires establishing an account and role-based access for your company's cleared facility:

1. Identify your Facility Security Officer (FSO) — the primary point of contact with DCSA; must be a U.S. citizen with appropriate clearance
2. Create a DCSA Portal account at dcsa.mil using your company CAGE code and DUNS number
3. Complete Identity Proofing (IDP) — remote identity verification process required for all portal users with access to classified information
4. Request role-based access — FSO, ISSO, Document Control, Visitor Control, and other roles each have separate access requests
5. Wait for ISR approval — your assigned ISR approves role access requests; typical processing 5–10 business days
6. Complete FSO training — DCSA requires FSO training completion within 90 days of appointment (FSO Level 1 and Level 2 training courses)

Ongoing DCSA Portal Obligations

Once onboarded, your company must maintain active portal access and submit required reports:

Step-by-Step NISP Compliance Roadmap

Whether you're seeking initial facility clearance or maintaining an existing FCL, here's a practical roadmap for staying compliant with DCSA NISP requirements.

• 1

  Identify Your FCL Requirement

  Review your current and anticipated classified contracts to determine the clearance level needed. If you don't yet have classified contracts but anticipate them, apply for FCL proactively — processing takes 60–120 days for new applications.

• 2

  Complete the SF-328 and Assess FOCI

  Before submitting your FCL application, complete the SF-328 and have your legal/ownership team review for any FOCI triggers. If FOCI is present, consult with DCSA on the appropriate mitigation instrument before submitting — this avoids processing delays.

• 3

  Onboard to the DCSA Portal

  Appoint an FSO and register for DCSA Portal access. Complete IDP for all users who will access classified information systems. Request ISSO appointment if you will process classified on IT systems.

• 4

  Build Your Security Program

  Develop your security plan per NISPOM Chapter 8. This includes physical security controls, classified system accreditation, visitor control procedures, and the appointment of key security staff (FSO, ISSO, courier personnel).

• 5

  Process Your First Classified Contract

  Review the DD Form 254 carefully before signing. Verify your FCL scope covers the required levels and information categories. Establish secure facilities and media accountability procedures before receiving classified material.

• 6

  Maintain Ongoing Compliance

  Complete annual self-inspections, report key manager and FOCI changes promptly, keep training records current in STEPP, and prepare for ISR periodic reviews. DCSA ISR visits typically occur every 12–18 months for active cleared facilities.

Maintaining NISP Compliance After Clearance

Receiving facility clearance is the starting point, not the finish line. DCSA conducts ongoing oversight through your Industrial Security Representative (ISR) and requires continuous compliance across several areas:

ISR Visits and Inspections

Your assigned ISR will conduct periodic facility inspections — typically annual for new or high-risk facilities, biennial for stable, lower-risk cleared facilities. Inspections review physical security, information systems security, personnel security practices, and FCL record-keeping. Preparation for ISR visits should be ongoing, not last-minute.

Annual Self-Inspection

Every cleared facility must complete an annual self-inspection and submit the results via the DCSA Portal. The self-inspection verifies continued compliance with all applicable NISPOM requirements and provides DCSA with a compliance status overview without requiring an on-site visit.

Key Personnel Requirements

Changes in key managers — FSO, CEO, or other senior leadership — must be reported to DCSA within 30 days. New key managers must complete background investigation requirements and in some cases may require DCSA approval before assuming their role in a cleared facility.

FOCI Monitoring

If your FOCI is mitigated through a formal agreement (Proxy Agreement, SSA, etc.), you have ongoing obligations including annual compliance certifications, governance committee meeting records, and reporting of any changes to the foreign ownership structure. Failure to maintain these obligations can trigger FCL suspension.

How DefenseBizStack Helps With NISP Compliance

DefenseBizStack provides tools and guidance that support your NISP compliance journey — from initial FCL application preparation through ongoing facility maintenance.

[AI-GENERATED] Content generated with AI assistance. DCSA NISP requirements are subject to change. Verify all regulatory claims against current DCSA policy at dcsa.mil and consult your assigned Industrial Security Representative (ISR) before making compliance decisions.